A traffic anomaly detection method and system based on data packet feature fusion

Abstract

The application discloses a traffic anomaly detection method and system based on data packet feature fusion, and the method comprises the following steps: preprocessing network traffic data, and taking the obtained result as an input sample of a model; using a CNN backbone network containing a lightweight efficient residual block (LERes) to extract discriminative features of the input sample; using a Proto prototype network to learn and calculate the similarity between the discriminative features and a plurality of preset categories of prototypes, obtaining a traffic classification result, and completing traffic anomaly detection; and the application significantly reduces the model parameter quantity and the reasoning time through lightweight structure design, and is suitable for resource-limited devices; and the similarity measurement of the Proto prototype enhances the model interpretability, and facilitates the tracing of the classification basis.

Description

TECHNICAL FIELD

[0001] The application relates to a traffic anomaly detection method and system, in particular to a traffic anomaly detection method and system based on data packet feature fusion, and belongs to the technical field of power system network security. BACKGROUND

[0002] With the increasing degree of Internet traffic encryption, traditional rule-based traffic classification technology based on deep packet inspection gradually fails, making users face serious threats in key tasks such as intrusion detection and service quality assurance. Although encrypted traffic improves privacy security, it hides application layer features, making traditional methods unable to effectively identify malicious traffic or distinguish business priorities, directly affecting network security management and resource optimization efficiency.

[0003] To address this challenge, deep learning-based traffic classification methods have emerged, which analyze data packet size, direction and other metadata to identify encrypted traffic. However, existing technologies still face multiple bottlenecks in actual deployment: first, mainstream deep learning models have a large number of parameters, making it difficult to adapt to the limited ARM CPU resources of network devices such as routers, resulting in insufficient real-time classification performance; second, existing methods rely heavily on post-hoc explanation techniques, and the model's explainability and actual decision logic are biased, making it difficult to meet the needs of responsibility tracing and compliance; in addition, most existing researches verify performance on small-scale datasets, which cannot reflect complex scenarios in real environments, and lack of public large-scale benchmark datasets, hindering technology comparability and practical application. SUMMARY

[0004] The purpose of the application is to provide a traffic anomaly detection method and system based on data packet feature fusion that can improve detection efficiency.

[0005] Technical solution: the traffic anomaly detection method based on data packet feature fusion provided by the application comprises:

[0006] Pretreatment of network traffic data, the obtained results are used as input samples of the model;

[0007] Using a CNN backbone network containing a lightweight and efficient residual block LERes to extract discriminative features of the input sample;

[0008] Using a Proto prototype network to learn and calculate the similarity between the discriminative features and the prototypes of a plurality of preset categories to obtain a traffic classification result and complete traffic anomaly detection.

[0009] Further, the pretreatment of network traffic data, the obtained results are used as input samples of the model, comprising:

[0010] Split the original traffic data by session to obtain byte data of multiple sessions;

[0011] Take a fixed number of data packets for each session, and calculate the size and transmission direction of the data packets;

[0012] The data packets, the size of the data packets, and the transmission direction of the data packets form a model input sample.

[0013] Further, the LERes is composed of two convolutional layers and a linear transformation layer, and the two convolutional operations have the same channel width by linear transformation to minimize memory access cost and inference time, and a shortcut connection is used to obtain a feature map as the output of the LERes.

[0014] Further, the two convolutional operations have the same channel width by linear transformation to minimize memory access cost and inference time, including: inputting the input sample into the first convolutional layer to obtain a feature map; doubling the number of feature maps output by the first convolutional layer using several linear transformations; splicing the feature maps obtained by the linear transformation and the feature maps output by the first convolutional layer as the input of the second convolutional layer; inputting the splicing result into the second convolutional layer with the same channel width, and outputting a new feature map.

[0015] Further, the shortcut connection is used to obtain a feature map as the output of the LERes, including: reserving the original input of the LERes, splicing the output of the first convolutional layer, adding the output of the second convolutional layer, and finally obtaining a feature representation of the traffic data through the Sigmod function activation, as the final output of the LERes.

[0016] Further, the Proto prototype network is used to learn and calculate the similarity of the discriminative features and the prototypes of the preset several categories to obtain the traffic classification result and complete the traffic anomaly detection, including: the Proto prototype network uses the LProto block; the output of the LERes block is used as the input of the LProto block, and the Prototype with the same depth as the channel number of the convolutional layer of the LERes block is used to calculate the L2 distance similarity matrix; L2 regularization is added to the weight of the Proto prototype network; then a global maximum pooling is used to reduce the activation map of the similarity matrix generated by each Prototype to a single similarity score, which is used to represent the existence degree of the prototype part in a certain patch of the input sample; finally, a fully connected layer is used to obtain the final classification result.

[0017] Further, it also includes: combining and training the CNN backbone network and the Proto prototype network, specifically including:

[0018] (1) update the weights of the CNN backbone network and the Proto prototype network while keeping the weights of the last layer unchanged;

[0019] (2) after a predetermined number of single-local training rounds, update the Prototype by projecting it to the nearest latent training patch from the same category;

[0020] (3) calculate the evaluation L2 distance of all samples to the closest prototype in its corresponding category to evaluate the discriminability of the learned prototype on the dataset;

[0021] (4) use kurtosis to evaluate the distance distribution, and if the distribution is a long-tailed distribution, add a Prototype in each category at the 25th percentile of the distribution;

[0022] (5) update the weights of the last layer only within a predetermined number of single-local training rounds while keeping the weights of the CNN backbone network and the Proto prototype network unchanged;

[0023] (6) repeat steps (1) to (5) until a predetermined number of global training rounds is reached.

[0024] Based on the same inventive concept, the application also provides a traffic anomaly detection system based on data packet feature fusion, comprising:

[0025] a preprocessing module for preprocessing network traffic data, and taking the obtained results as input samples of the model;

[0026] an extraction module for extracting discriminative features of the input samples using a CNN backbone network containing a lightweight and efficient residual block LERes;

[0027] a detection module for learning and calculating the similarity between the discriminative features and the prototypes of a plurality of predetermined categories using a Proto prototype network, obtaining a traffic classification result, and completing traffic anomaly detection.

[0028] Further, the preprocessing module comprises:

[0029] segmenting the original traffic data by session to obtain byte data of multiple sessions;

[0030] taking a fixed number of data packets from each session and calculating the size and transmission direction of the data packets;

[0031] grouping the data packets, the size of the data packets and the transmission direction of the data packets into model input samples.

[0032] Further, the LERes is composed of two convolutional layers and a linear transformation layer, the two convolutional operations have the same channel width by linear transformation to minimize memory access cost and inference time, and the shortcut connection is used to obtain the feature map as the output of the LERes.

[0033] Further, the two convolutional operations have the same channel width by linear transformation to minimize memory access cost and inference time, comprising: inputting the input sample into the first convolutional layer to obtain the feature map; doubling the number of feature maps output by the first convolutional layer using several times of linear transformation; splicing the feature maps obtained by the linear transformation and the feature maps output by the first convolutional layer as the input of the second convolutional layer; inputting the splicing result into the second convolutional layer with the same channel width to output new feature maps.

[0034] Further, the shortcut connection is used to obtain the feature map as the output of the LERes, comprising: reserving the original input of the LERes, splicing the output of the first convolutional layer, adding the output of the second convolutional layer, and finally obtaining the feature representation of the traffic data through the Sigmod function activation as the final output of the LERes.

[0035] Further, the detection module comprises: the Proto prototype network uses the LProto block; the output of the LERes block is used as the input of the LProto block, the Prototype with the same depth as the channel number of the convolutional layer of the LERes block is used to calculate the L2 distance similarity matrix of the input; the L2 regularization is added to the weight of the Proto prototype network; then the global maximum pooling is used to reduce the activation map of the similarity matrix generated by each Prototype to a single similarity score, which is used to represent the existence degree of the prototype part in a certain patch of the input sample; finally, a fully connected layer is used to obtain the final classification result.

[0036] Further, it further comprises: combining and training the CNN backbone network and the Proto prototype network, specifically comprising:

[0037] (1) updating the weights of the CNN backbone network and the Proto prototype network while keeping the weights of the last layer unchanged;

[0038] (2) after a predetermined number of local training rounds, updating the Prototype by projecting it to the nearest latent training patch from the same category;

[0039] (3) calculating the evaluation L2 distance of all samples to the closest prototype in their corresponding category to evaluate the discriminability of the learned prototype on the data set;

[0040] (4) Adopt kurtosis to evaluate distance distribution, if the distribution is long-tailed distribution, add a Prototype in each class of the 25th percentile of the distribution;

[0041] (5) Update the weight of the last layer only while keeping the weight of the CNN backbone network and the Proto prototype network unchanged within a predetermined number of single local training rounds;

[0042] (6) Repeat steps (1) to (5) until a preset global training round is reached.

[0043] Based on the same inventive concept, the application further provides a computing device comprising one or more processors, one or more memories, and one or more programs stored in the memories and configured to be executed by the processors, the programs, when loaded into the processors, implement the steps of the traffic anomaly detection method based on packet feature fusion according to any one of the above.

[0044] Based on the same inventive concept, the application further provides a storage medium storing a computer program, the computer program comprising program instructions, the program instructions, when executed by a processor, causing the processor to perform the steps of the traffic anomaly detection method based on packet feature fusion according to any one of the above.

[0045] Advantages: Compared with the prior art, the application adopts a more lightweight structure through the LERes module and the LProto module, reduces the number of parameters and CPU inference time of the model while ensuring that the network accuracy does not decrease significantly, and improves the model classification efficiency; when comparing network traffic from different sources, the application uses the Prototype method to allow users to identify different characteristics of traffic from different sources, and the model tends to highlight the prominent features of a position in the traffic, providing users with easy-to-understand explanations in most cases and enhancing the explainability of the model; the application overcomes the problems of high computing power requirement and low explainability of existing methods. BRIEF DESCRIPTION OF DRAWINGS

[0046] Figure 1 The method flowchart of the embodiments of the application;

[0047] Figure 2 The LERes structure schematic diagram of the embodiments of the application;

[0048] Figure 3 The LProto block structure schematic diagram of the embodiments of the application. DETAILED DESCRIPTION

[0049] In order to enable personnel in the technical field to better understand the technical scheme of the present application, the technical scheme in the embodiments of the present application will be described clearly and completely in combination with the drawings in the embodiments of the present application. The following embodiments are only used to more clearly illustrate the technical scheme of the present application, and cannot be used to limit the protection scope of the present application.

[0050] As shown in Figure 1 , the traffic anomaly detection method based on data packet feature fusion of the present embodiment comprises:

[0051] Step 1: Preprocessing the network traffic data, and taking the obtained result as the input sample of the model;

[0052] Step 2: Using a CNN backbone network containing a lightweight and efficient residual block (LERes) to extract the discriminative features of the input sample;

[0053] Step 3: Using a Proto prototype network to learn and calculate the similarity between the discriminative features and the prototypes of a plurality of preset categories, obtaining the traffic classification result, and completing the traffic anomaly detection.

[0054] Specifically, in step 1, the network traffic data is preprocessed, including: dividing the original traffic data according to sessions to obtain byte data of a plurality of sessions; taking the first 20 data packets of each session, and calculating the size and transmission direction of these data packets; and grouping these data packets, packet size and transmission direction to form a model input sample.

[0055] In step 2, the CNN backbone network uses a lightweight and efficient residual block (LERes), as shown in Figure 2 , which is composed of two convolutional layers and a linear transformation layer; the linear transformation is used to keep the two convolutional operations with the same channel width to minimize the memory access cost and inference time; and a shortcut link is used to obtain a feature map as the output of the LERes block. Specifically:

[0056] (2-1) Inputting the input data with a dimension of 20x2x32 into a first convolutional layer with a convolutional kernel size of 3x3 to obtain a feature map; using a series of linear kernels with a size of 3x3 to double the number of feature maps output by the first convolutional layer; splicing the feature maps obtained by the linear transformation and the feature maps output by the first convolutional layer as the input of the second convolutional layer to ensure that the channel width of the two convolutional layers is the same; and inputting the splicing result into the second convolutional layer with the same channel width to output a new feature map.

[0057] (2-2) The original input of the LRes block is reserved, spliced with the output of the first convolutional layer, added with the output of the second convolutional layer, and finally activated by a Sigmod function to obtain a feature representation of the traffic data as the final output of the LRes block.

[0058] In step 3, the Proto prototype network is used to learn and calculate the similarity between the discriminative features and the prototypes of a specific category to obtain a traffic classification result, and complete traffic anomaly detection, including: the Proto prototype network uses an LProto block as shown in Figure 3 ; the output of the LRes block is used as the input of the LProto block, and 200 prototypes with a depth of 32 are used to calculate an L2 distance similarity matrix of the input; L2 regularization is added to the weight of the prototype to further improve the accuracy of the network; the Proto prototype network supports a dynamic number of learnable prototypes to ensure that the network has enough prototypes to distinguish different categories of traffic; then a global max pooling is used to reduce the activation map of the similarity matrix generated by each prototype to a single similarity score, which indicates how strong the presence of the prototype is in a certain patch of the input sample; finally, the similarity matrix is activated by a Sigmod function and then passes through a fully connected layer to obtain the final classification result.

[0059] The method of the embodiment further includes: updating the weights of the CNN backbone network and the Proto prototype network while keeping the weights of the last layer unchanged; initializing the network, and each category has only one prototype; after 20 training times, updating the prototypes by projecting them onto the nearest latent training patch from the same category; calculating the average L2 distance of all samples to the closest prototype in their corresponding category, which is 1x2, and 2 is the total number of categories, to evaluate the discriminative ability of the learned prototypes on the data set; using kurtosis to evaluate the distance distribution, if the distribution is a long-tailed distribution, add a prototype to each category at the 25th percentile of the distribution; finally, within a predetermined number of local training rounds, only update the weights of the last layer while keeping the weights of the CNN backbone network and the Proto prototype network unchanged. Repeat the above operations until the global training rounds are reached.

[0060] Based on the same inventive concept, the embodiment also provides a traffic anomaly detection system based on packet feature fusion, including:

[0061] A preprocessing module is configured to preprocess network traffic data, and the obtained result is used as an input sample of a model.

[0062] An extraction module is configured to extract discriminative features of an input sample using a CNN backbone network containing a lightweight efficient residual block (LERes).

[0063] A detection module is configured to learn and calculate similarities between the discriminative features and prototypes of a plurality of preset categories using a Proto network, to obtain a traffic classification result, and to complete traffic anomaly detection.

[0064] Further, the preprocessing module comprises:

[0065] The original traffic data is segmented according to sessions to obtain byte data of a plurality of sessions.

[0066] A fixed number of data packets are taken from each session, and sizes and transmission directions of the data packets are calculated.

[0067] The data packets, the sizes of the data packets, and the transmission directions of the data packets are combined to form model input samples.

[0068] Further, the LERes is composed of two convolution layers and a linear transformation layer, the two convolution operations have the same channel width through linear transformation, the memory access cost and the inference time are minimized, and a shortcut connection is used to obtain a feature map as the output of the LERes.

[0069] Further, the two convolution operations have the same channel width through linear transformation to minimize the memory access cost and the inference time, which includes: inputting an input sample into a first convolution layer to obtain a feature map; doubling the number of the feature map output by the first convolution layer using a plurality of times of linear transformation; splicing the feature map obtained through the linear transformation and the feature map output by the first convolution layer as an input of a second convolution layer; and inputting the splicing result into the second convolution layer with the same channel width to output a new feature map.

[0070] Further, the shortcut connection is used to obtain the feature map as the output of the LERes, which includes: reserving an original input of the LERes, splicing the output of the first convolution layer, adding the output of the second convolution layer, and finally obtaining a feature representation of traffic data through a Sigmod function activation, as the final output of the LERes.

[0071] Further, the detection module comprises: a Proto prototype network using an LProto block; an output of an LERes block is used as an input of the LProto block, an L2 distance similarity matrix of the input is calculated using a Prototype with the same depth as a convolutional layer channel number of the LERes block; L2 regularization is added to a weight of the Prototype; then a global maximum pooling is used to reduce an activation map of a similarity matrix generated by each Prototype to a single similarity score, which is used to represent a presence degree of a part of the Prototype in a certain patch of the input sample; and finally, a fully connected layer is used to obtain a final classification result.

[0072] Further, the method further comprises: combining and training the CNN backbone network and the Proto prototype network, and specifically comprising:

[0073] (1) updating weights of the CNN backbone network and the Proto prototype network while keeping weights of a last layer unchanged;

[0074] (2) after a predetermined number of single local training rounds, updating the Prototype by projecting the Prototype to the nearest potential training patch from the same classification;

[0075] (3) calculating an evaluation L2 distance of all samples to the closest Prototype in a corresponding classification of the Prototype to evaluate a discrimination ability of the learned Prototype on the data set;

[0076] (4) using kurtosis to evaluate a distance distribution, if the distribution is a long-tail distribution, adding a Prototype in each classification at a 25th percentile of the distribution;

[0077] (5) within a predetermined number of single local training rounds, only updating weights of the last layer while keeping weights of the CNN backbone network and the Proto prototype network unchanged;

[0078] (6) repeating steps (1) to (5) until a preset global training round is reached.

[0079] Based on the same inventive concept, the embodiment also provides a computing device comprising: one or more processors, one or more memories, and one or more programs stored in the memories and configured to be executed by the processors, the programs, when loaded into the processors, implement steps of the traffic anomaly detection method based on data packet feature fusion according to any one of the above.

[0080] Based on the same inventive concept, the embodiment also provides a storage medium, which stores a computer program including program instructions, the program instructions causing a processor to execute steps of the traffic anomaly detection method based on data packet feature fusion according to any one of the above when executed by the processor.

[0081] Embodiments of the present application can be implemented in a method, a system, or a computer program product. Therefore, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage, etc.) having computer usable program code embodied thereon. The solutions in the embodiments of the present application can be implemented by using various computer languages, such as the object-oriented programming language Java and the interpreted scripting language JavaScript.

[0082] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, as well as combinations of flows and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing apparatus to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing apparatus generate an apparatus that implements the flow Figure 1 one or more flows and / or blocks Figure 1 an apparatus with a function specified in one or more flows and / or blocks.

[0083] These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to work in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including an instruction apparatus that implements the flow Figure 1 one or more flows and / or blocks Figure 1 an apparatus with a function specified in one or more flows and / or blocks.

[0084] Although the preferred embodiments of the present application have been described, those skilled in the art who have the basic inventive concept can make additional changes and modifications to the embodiments. Therefore, the appended claims are intended to include the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0085] Obviously, many modifications and variations of the present application are possible in light of the above teachings. It is, therefore, to be understood that within the scope of the appended claims and their equivalents, the application can be practiced otherwise than as specifically described.

Claims

1. A traffic anomaly detection method based on data packet feature fusion, characterized in that, The application relates to a network traffic anomaly detection method based on CNN and Proto networks. The application comprises the following steps: Preprocessing network traffic data, taking the obtained result as an input sample of a model; Using a CNN backbone network containing a lightweight and efficient residual block (LERes) to extract discriminative features of the input sample; Using a Proto network to learn and calculate the similarity between the discriminative features and preset prototypes of several categories, obtaining a traffic classification result and completing traffic anomaly detection; The LERes is composed of two convolution layers and a linear transformation layer, the two convolution operations have the same channel width through linear transformation, the memory access cost and inference time are minimized, and a shortcut connection is used to obtain a feature map as the output of the LERes; The two convolution operations have the same channel width through linear transformation, the memory access cost and inference time are minimized, which comprises the following steps: inputting an input sample into a first convolution layer to obtain a feature map; doubling the number of the feature map output by the first convolution layer through several times of linear transformation; splicing the feature map obtained through linear transformation and the feature map output by the first convolution layer as the input of a second convolution layer; inputting the splicing result into the second convolution layer with the same channel width, and outputting a new feature map; The shortcut connection is used to obtain the feature map as the output of the LERes, which comprises the following steps: reserving the original input of the LERes, splicing the output of the first convolution layer, adding the output of the second convolution layer, and finally obtaining a feature representation of traffic data through a Sigmod function activation, which is the final output of the LERes; 2.The traffic anomaly detection method based on data packet feature fusion according to claim 1, characterized in that, The Proto network uses an LProto block; the output of the LERes block is used as the input of the LProto block, an L2 distance similarity matrix is calculated by using a Prototype with the same depth as the channel number of the convolution layer of the LERes block; L2 regularization is added to the weight of the Proto network; then a global maximum pooling is used to reduce the activation map of the similarity matrix generated by each Prototype to a single similarity score, which is used to represent the existence degree of the Prototype in a certain patch of the input sample; finally, a fully connected layer is used to obtain a final classification result. The preprocessing of network traffic data, taking the obtained result as an input sample of a model, comprises the following steps: Dividing original traffic data according to sessions to obtain byte data of multiple sessions; Taking a fixed number of data packets from each session, and calculating the size and transmission direction of the data packets; 3.The traffic anomaly detection method based on data packet feature fusion according to claim 1, characterized in that, The data packets, the size of the data packets and the transmission direction of the data packets are combined to form a model input sample. The application further comprises the following steps: Combining and training the CNN backbone network and the Proto network, specifically comprising the following steps: (1) updating the weights of the CNN backbone network and the Proto network while keeping the weights of the last layer unchanged; (2) after a predetermined number of single local training rounds, updating the Prototype by projecting it onto the nearest potential training patch from the same category. (3) Calculate the evaluation L2 distance of all samples to the nearest prototype in its corresponding category to evaluate the discriminability of the learned prototypes on the dataset; (4) Use kurtosis to evaluate the distance distribution, and if the distribution is a long-tailed distribution, add a Prototype in each category at the 25th percentile of the distribution; (5) Update only the weights of the last layer within a predetermined number of single local training rounds, while keeping the weights of the CNN backbone network and the Proto prototype network unchanged; (6) Repeat steps (1) to (5) until a predetermined global training round is reached.

4. A traffic anomaly detection system based on data packet feature fusion, characterized in that, Comprise: A preprocessing module for preprocessing network traffic data, and taking the obtained results as input samples of the model; An extraction module for extracting discriminative features of the input samples using a CNN backbone network containing a lightweight and efficient residual block LRes; A detection module for learning and calculating the similarity of the discriminative features and the prototypes of a plurality of predetermined categories using a Proto prototype network, obtaining a traffic classification result, and completing traffic anomaly detection; The LRes is composed of two convolutional layers and a linear transformation layer, which maintains the same channel width of the two convolutional operations through linear transformation to minimize memory access cost and inference time, and uses a shortcut connection to obtain a feature map as the output of the LRes; The linear transformation maintains the same channel width of the two convolutional operations to minimize memory access cost and inference time, which includes inputting the input sample into the first convolutional layer to obtain a feature map; using a plurality of times of linear transformation to double the number of feature maps output by the first convolutional layer; splicing the feature maps obtained by linear transformation and the feature maps output by the first convolutional layer as the input of the second convolutional layer; inputting the splicing result into the second convolutional layer with the same channel width to output a new feature map; The shortcut connection is used to obtain a feature map as the output of the LRes, which includes reserving the original input of the LRes, splicing the output of the first convolutional layer, adding the output of the second convolutional layer, and finally obtaining the feature representation of the traffic data through the activation of the Sigmod function, as the final output of the LRes; The detection module comprises: the Proto prototype network uses an LProto block; the output of the LRes block is used as the input of the LProto block, and the L2 distance similarity matrix of the input is calculated using the Prototype with the same depth as the channel number of the convolutional layer of the LRes block; L2 regularization is added to the weight of the Proto prototype network; then a global maximum pooling is used to reduce the activation map of each Prototype to a single similarity score, which is used to represent the existence degree of the prototype in a certain patch of the input sample; finally, a fully connected layer is used to obtain the final classification result. 5.The packet feature fusion based traffic anomaly detection system according to claim 4, wherein, The preprocessing module comprises: The original traffic data is segmented according to the session to obtain byte data of a plurality of sessions; A fixed number of data packets are taken from each session, and the size and transmission direction of the data packets are calculated; The data packets, the size of the data packets, and the transmission direction of the data packets are combined to form model input samples. 6.The packet feature fusion based traffic anomaly detection system according to claim 4, wherein, Also included are: The CNN backbone network and the Proto prototype network are combined and trained, specifically including: (1) updating the weights of the CNN backbone network and the Proto prototype network, while keeping the weights of the last layer unchanged; (2) after a predetermined number of single rounds of training, update the Prototype by projecting it onto the nearest latent training patch from the same class; (3) calculate the evaluation L2 distance of all samples to the closest prototype in its corresponding class to evaluate the discriminability of the learned prototype on the dataset; (4) evaluate the distance distribution using kurtosis, if the distribution is a long-tailed distribution, add a Prototype in each class at the 25th percentile of the distribution; (5) within a predetermined number of single rounds of training, only update the weights of the last layer, while keeping the weights of the CNN backbone network and the Proto prototype network unchanged; (6) repeat steps (1) to (5) until a predetermined number of global training rounds is reached.

7. A computing device, comprising: Comprise: One or more processors, one or more memories, and one or more programs, the programs stored in the memories and configured to be executed by the processors, the programs, when loaded into the processors, implement the steps of the traffic anomaly detection method based on packet feature fusion according to any one of claims 1 to 3.

8. A storage medium, characterized by The storage medium stores a computer program, the computer program comprising program instructions, the program instructions causing the processor to execute the steps of the traffic anomaly detection method based on packet feature fusion according to any one of claims 1 to 3 when executed by the processor.

Images